AI agents are becoming increasingly capable of doing things on our behalf.
They can read documents, access databases, call APIs, use external tools, communicate with other agents, and execute long-running workflows with considerably less human intervention than traditional software.
That capability creates a problem that traditional permission systems weren't designed to solve.
An agent may have permission to access a piece of information, but that doesn't necessarily mean it is appropriate for the agent to use or transmit that information in a particular context.
That distinction is at the center of a recent Google Research workshop report, Open and Emergent Problems in Agentic Privacy and Security: A Contextual Angle, introduced on the Google Research blog on October 5, 2026 by Eugene Bagdasarian and Marco Gruteser.
The report came out of the Google Contextual Agent Privacy and Security (CAPS) Workshop, held in New York in late 2025 with more than 50 academic and industry leaders. It explores how contextual integrity could provide a foundation for privacy and security policies in increasingly autonomous agentic systems. (Google Research)
It also calls for standardized environments for evaluating the safety of multi-agent systems.
The important part isn't that Google has released a production policy engine.
It hasn't.
The interesting part is the architectural direction being proposed:
Instead of asking only whether an agent is technically allowed to access information, ask whether that information flow is appropriate in the current context.
For engineers building systems that allow agents to interact with personal, enterprise, or sensitive data, that is a significant shift in thinking.
The proposal on one page: a contextual policy engine between agents and the data and tools they use, plus open "Agent Gym" environments to test how multiple agents behave together.
Why traditional permissions aren't enough for AI agents
Traditional access control generally answers a relatively straightforward question:
Can this identity access this resource?
For example:
User → Database
│
└── SELECT permission? → YES
That works well when the software behavior is relatively predictable.
An autonomous agent is different.
Imagine an agent has legitimate access to a customer's account information.
The agent could potentially:
- read the customer's address
- send that address to another service
- include it in a generated report
- share it with another agent
- use it to make a decision
- store it in a different system
The fact that the agent can access the information doesn't answer whether every one of those actions is appropriate.
The missing dimension is context.
Google Research's report argues that traditional manual permissions and expert-written policies struggle to scale when agents can dynamically discover tools, interact with other agents, and execute long-running tasks.
That leads to a different question:
Is this information flow appropriate here, for this purpose, between these parties, under these conditions?
Contextual integrity gives us a different model
The idea comes from contextual integrity, a privacy theory developed by Helen Nissenbaum around the principle that privacy depends on whether information flows appropriately within a particular social context.
Instead of treating privacy as simply:
allowed / denied
the system considers the circumstances surrounding an information transfer.
The Google Research report applies this idea to agentic systems and discusses three important components:
Actors
+
Information type
+
Transmission principle
Actors
Who is involved?
For example:
User
Agent
Organization
Third-party service
Another agent
Information type
What information is being transferred?
For example:
Personal data
Financial data
Enterprise data
Documents
Operational data
Credentials
Transmission principle
Under what conditions is the information being transferred?
For example:
User consent
Specific task
Business purpose
Legal requirement
Security requirement
Together, these provide a much richer policy description than a simple access-control rule.
From access control to contextual policy
Consider an employee asking an AI agent:
"Find the latest status of my company's supplier contracts."
A traditional permission system might determine:
Employee
↓
Contract database
↓
Access allowed
A contextual policy engine could reason about something more specific:
Actor:
Employee + Agent
Information:
Supplier contracts
Purpose:
Contract-status investigation
Destination:
Internal workspace
Transmission:
Allowed for this task
Now change one variable.
The agent wants to send the same contract information to an external summarization service.
The underlying database permission hasn't changed.
But the context has.
A contextual policy could therefore produce:
Internal retrieval → ALLOW
External transmission → BLOCK
That is the conceptual leap.
The policy isn't merely attached to the database.
It evaluates the information flow.
This is an excerpt. The full article continues with:
- What Google Research is proposing: a contextual policy engine
- The dynamic policy problem
- Why this matters for multi-agent systems
- The benchmark problem
- Agent Gym: evaluating agents in environments
- The engineering trade-off
- This is where data engineers should pay attention
- What AI engineers should do today
Read the full article on AI Data Legends, with diagrams, code and sources.
Top comments (0)